shareplay-activities
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a communication interface that processes data received from peer participants in a shared session.\n
- Ingestion points: Untrusted data enters the agent context via
messenger.messages(of:)calls in theDrawingManager,SharePlayManager, andQuizManagercomponents found inreferences/shareplay-patterns.md.\n - Boundary markers: Absent. The skill does not provide instructions to include delimiters or warnings to ignore potentially malicious embedded instructions in the peer messages.\n
- Capability inventory: The skill's handlers are limited to updating local application state, such as managing drawing strokes, participant lists, and score tracking. No high-privilege capabilities like file system modifications or external network requests are present within these handlers.\n
- Sanitization: Absent. The logic relies on standard Codable decoding but lacks specific validation, filtering, or escaping of the received message content.\n- [EXTERNAL_DOWNLOADS]: The skill contains references to documentation hosted on a non-official external domain.\n
- Evidence:
SKILL.mdincludes multiple links tohttps://sosumi.ai/documentation/groupactivitiesand its subdirectories.
Audit Metadata